CISA has pointed out

Actions for Organizations to Take Today to Mitigate Cyber Threats Related to Akira Ransomware Activity

Prioritize remediating known exploited vulnerabilities.

Prioritize remediating known exploited vulnerabilities.

Enable and enforce phishing-resistant multifactor authentication (MFA).

Enable and enforce phishing-resistant multifactor authentication (MFA).

Maintain regular backups of critical data, ensure backups are stored offline, and regularly test the restoration process.

Maintain regular backups of critical data, ensure backups are stored offline, and regularly test the restoration process.

Note: Originally published April 18, 2024, this advisory was updated Nov. 13, 2025, with information on new Akira ransomware activity that presents an imminent threat to critical infrastructure. Updated information is labeled with “Update Nov. 13, 2025” at the beginning and “End Update” at the end of sections that include substantive new information, such as new Akira threat actor activity, TTPs, and IOCs.

Update Nov. 13, 2025:

The United States’ Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Defense Cyber Crime Center (DC3), and Department of Health and Human Services (HHS); Europol’s European Cybercrime Centre (EC3); France’s Office Anti-Cybercriminalite (OFAC) – French Cybercrime Central Office; Germany’s Generalstaatsanwaltschaft Karlsruhe – Cybercrime-Zentrum Baden-Württemberg and Landeskriminalamt Baden-Württemberg; and the Netherlands’s National Cyber Security Centre (NCSC-NL)—hereafter referred to as the “authoring organizations”—are releasing this joint advisory to disseminate known Akira ransomware IOCs and TTPs identified through FBI investigations and trusted third-party reporting as recently as November 2025.

Akira ransomware threat actors are associated with other groups known as Storm-1567, Howling Scorpius, Punk Spider, and Gold Sahara, and may have connections to the defunct Conti ransomware group. Akira threat actors primarily target small- and medium-sized businesses, but have also impacted larger organizations across various sectors. They have a notable preference for educational institutions and organizations in the Critical Manufacturing, Information Technology , Healthcare and Public Health , Financial Services , and Food and Agriculture sectors.

Since March 2023, Akira ransomware threat actors have impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia. In April 2023, following an initial focus on Windows systems, Akira threat actors deployed a Linux variant targeting VMware Elastic Sky X Integrated (ESXi) virtual machines (VMs).

Update Nov. 13, 2025:

Based on trusted third-party reporting, Akira threat actors deployed payloads to target Nutanix Acropolis Hypervisor (AHV) systems in a June 2025 incident.

Akira threat actors likely abused Common Vulnerabilities and Exposures (CVE)-2024-40766 (Common Weakness Enumeration [CWE]-284: Improper Access Control ), a SonicWall vulnerability, for initial access. As of late September 2025, Akira ransomware has claimed approximately $244.17 million (USD) in ransomware proceeds.

Early versions of the Akira ransomware variant used C++ to write the code and encrypted files with a .akira extension; however, beginning in August 2023, some Akira attacks began deploying a Megazord encryptor—a Rust-based tool that encrypts files with a .powerranges extension. Akira threat actors have continued to use both Megazord and Akira (including Akira_v2 , as identified by trusted third-party investigations) interchangeably.

The authoring organizations encourage organizations to implement the recommendations in the Mitigations section of this advisory to reduce the likelihood and impact of Akira ransomware incidents.

Download the PDF version of this report:

For a downloadable copy of Nov. 13, 2025 IOCs, see:

For a downloadable copy of historic IOCs, see:

Note: This advisory uses the MITRE ATT&CK ® Matrix for Enterprise framework, version 18. See the MITRE ATT&CK Tactics and Techniques section of this advisory for tables with the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

FBI and cybersecurity researchers 1 observed Akira threat actors obtaining initial access to organizations through a virtual private network (VPN) service without multifactor authentication (MFA) configured, 2 mostly using known Common Vulnerabilities and Exposures (CVEs) [ T1190 ], including:

CVE-2020-3259 [ Common Weakness Enumeration (CWE)-200: Exposure of Sensitive Information to an Unauthorized Actor ];

CVE-2023-20269 [ CWE-288: Authentication Bypass Using an Alternate Path or Channel ];

Update Nov. 13, 2025:

CVE-2020-3580 [ CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) ] 3

CVE-2023-28252 [ CWE-122: Heap-based Buffer Overflow ]; 4 and

CVE-2024-37085 [ CWE-305: Authentication Bypass by Primary Weakness ]. 5

Additionally, the authoring organizations observed Akira threat actors using these CVE exploits for initial access:

CVE-2023-27532 [ CWE-306: Missing Authentication for Critical Function ];

CVE-2024-40711 [ CWE-502: Deserialization of Untrusted Data ]; and

CVE-2024-40766 [ CWE-284: Improper Access Control ].

For initial access, Akira threat actors also use techniques including spearphishing [ T1566.001 ][ T1566.002 ], abusing valid credentials [ T1078 ], and techniques that leverage external-facing services, like Remote Desktop Protocol (RDP) [ T1133 ]. 6

Update Nov. 13, 2025:

Akira threat actors gain access to VPN products such as SonicWall, by stealing login credentials or exploiting vulnerabilities like CVE-2024-40766 . In some instances, they gain initial access through compromised VPN credentials, potentially by using initial access brokers or brute-forcing VPN endpoints [ T1110 ]. Additionally, Akira threat actors deploy password spraying techniques, using tools such as SharpDomainSpray to gain access to account credentials [ T1110.003 ].

Akira threat actors also deploy payloads to target Nutanix Acropolis Hypervisor (AHV) systems; this is the first observed instance in which Akira threat actors encrypted Nutanix AHV virtual machine (VM) disk files, indicating that they targeted hypervisors beyond the historical targeting of VMware ESXi and Hyper-V.

In other incidents, indicators suggest that Akira threat actors gained initial access through the Secure Shell (SSH) protocol by exploiting a router’s IP address [ T1021.004 ]. After tunneling through a targeted router, Akira threat actors exploit publicly available vulnerabilities, such as those found in the Veeam Backup and Replication component of unpatched Veeam backup servers [ T1068 ] ( CVE-2023-27532 and CVE-2024-40711 ). 7

Update Nov. 13, 2025:

Akira threat actors frequently execute malicious commands by using Visual Basic (VB) scripts (event-driven programming languages that allow documents to contain macros to improve functionality through autonomous task execution) [ T1059.005 ].

Persistence and Discovery

Once initial access is achieved, Akira threat actors attempt to establish persistence by creating new domain accounts [ T1136.002 ] to abuse the functions of domain controllers. In some instances, the authoring organizations identified Akira threat actors creating an administrative account named itadm .

According to the authoring organizations and open source reporting, Akira threat actors leverage post-exploitation techniques, such as Kerberoasting, 8 to extract credentials stored in the process memory of the Local Security Authority Subsystem Service (LSASS) 9 [ T1003.001 ]. Akira threat actors also use credential scraping tools [ T1003 ], like Mimikatz and LaZagne , to aid in privilege escalation. For network discovery and reconnaissance, actors use tools like SoftPerfect, Advanced IP Scanner, and NetScan [ T1016 ]. net Windows commands [ T1059.003 ] are used to identify domain controllers [ T1018 ] and gather information on domain trust relationships [ T1482 ].

See Table 1 for a descriptive listing of tools leveraged for malicious purposes by Akira threat actors.

Update Nov. 13, 2025:

The authoring organizations observed Akira threat actors using nltest /dclist: and nltest /DOMAIN_TRUSTS [ T1018 ][ T1482 ] for network and domain discovery.

As Akira threat actors prepare for lateral movement, they commonly disable security software to avoid detection. Cybersecurity researchers observed Akira threat actors using PowerTool to exploit the Zemana AntiMalware driver 10 and terminate antivirus-related processes [ T1562.001 ].

Update Nov. 13, 2025:

In addition, the authoring organizations observed Akira threat actors abusing remote access tools such as AnyDesk and LogMeIn [ T1219 ] to maintain persistence and blend in with administrator activity. Akira threat actors leverage Impacket (an open source tool designed for network protocol manipulation) to execute the remote command wmiexec.py . To evade detection, Akira threat actors implement techniques such as uninstalling endpoint detection and response (EDR) systems [ T1562.001 ].

Update Nov. 13, 2025:

The authoring organizations observed Akira threat actors creating new user accounts and adding them to the administrator group to establish a foothold in the environment [ T1136.001 ]. In a reported incident, Akira threat actors bypassed Virtual Machine Disk (VMDK) file protection by temporarily powering down the domain controller’s VM, copying the VMDK files, and attaching them to a newly created VM. This sequence of actions enabled them to extract the NTDS.dit file and the SYSTEM hive, ultimately compromising a highly privileged domain administrator’s account [ T1003.002 ][ T1003.003 ]. 11 Akira threat actors have also been observed leveraging services like Veeam.Backup.MountService.exe for privilege escalation ( CVE-2024-40711 ) [ T1068 ].

Update Nov. 13, 2025:

To pivot laterally, Akira threat actors use legitimate remote access tools like AnyDesk or LogMeIn [ T1219 ]. They also employ RDP [ T1021.001 ], SSH [ T1021.004 ], and MobaXterm to expand their presence within the compromised network [ T1021 ].

Update Nov. 13, 2025:

Based on observations from the authoring organizations and trusted third-party reporting, it has been determined that Megazord has likely fallen out of use since 2024. 12

Trusted third-party investigations revealed that Akira threat actors deployed two distinct ransomware variants against different system architectures during one attempted compromise. Analysts first identified Akira threat actors deploying the Windows-specific “Megazord” ransomware, and further investigation revealed the threat actors concurrently deployed a second payload during the attack, later identified as a novel variant of the Akira ESXi encryptor, Akira_v2 .

Update Nov. 13, 2025:

The authoring organizations observed Akira threat actors establishing command and control (C2) communications by using tunneling utilities, such as Ngrok [ T1572 ], to initiate encrypted sessions that bypass perimeter monitoring. They also use PowerShell and Windows Management Instrumentation Command-line (WMIC) [ T1059.001 ] to disable services and execute malicious scripts.

Exfiltration and Impact

Akira threat actors leverage tools such as FileZilla and WinRAR to collect data [ T1560.001 ] and WinSCP and RClone to exfiltrate data [ T1048 ]. To establish C2 channels, threat actors leverage readily available tools like AnyDesk, MobaXterm, RustDesk, and Cloudflare Tunnel. These tools enable exfiltration through various protocols such as File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), and cloud storage services like Mega [ T1537 ], to connect to exfiltration servers. In some instances, Akira threat actors use Ngrok to create secure tunnels for data exfiltration [ T1090 ].

After exfiltrating data, Akira threat actors use a double-extortion model [ T1657 ], which involves threat actors both encrypting systems [ T1486 ] and threatening to leak sensitive information. The Akira ransom note provides each company with a unique code and instructions to the threat actors via a .onion URL, which is accessible through the Tor network [ T1090.003 ][ T1573.002 ].

( Note: Tor , short for The Onion Router, is a decentralized network designed to anonymize internet traffic by routing it through multiple servers, encrypting data at each step. This network is often leveraged by threat actors to conceal their identities and activities, enabling secure and anonymous communication channels for malicious purposes, such as ransomware negotiations.)

Akira threat actors do not leave an initial ransom demand or payment instructions on compromised networks and do not relay this information until contacted by the victim. Victims make ransom payments by using Bitcoin to cryptocurrency-wallet addresses provided by the Akira threat actors. To further apply pressure, Akira threat actors threaten to publish exfiltrated data on the Tor network, and in some instances have called victimized companies, according to FBI reporting.

Update Nov. 13, 2025:

In some incidents, Akira threat actors exfiltrated data in just over two hours from initial access. 13

Akira threat actors use a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20 stream cipher with an RSA public-key cryptosystem for a fast and secure key exchange [ T1486 ]. This multilayered approach customizes encryption methods based on file type and size, and enables full or partial encryption. Encrypted files are appended with a .akira or .powerranges extension.

Update Nov. 13, 2025:

With the new Akira_v2 variant, encrypted files are appended either with an .akira or .powerranges extension, or with .akiranew or .aki .

To further inhibit system recovery and impede forensic analysis, Akira’s encryptor ( w.exe ) uses PowerShell commands to delete Volume Shadow Copy Service (VSS) copies on Windows systems [ T1490 ].

Update Nov. 13, 2025:

Additionally, a ransom note named fn.txt or akira_readme.txt appears in both the root directory ( C: ) and each user’s directory ( C:\Users ).

Trusted third-party analysis determined the Akira_v2 encryptor is an upgrade from its version and includes additional functionalities because it is written in Rust. versions of the encryptor provided options to insert arguments at runtime, including:

- p –encryption_path (targeted file/folder paths);

-s –share_file (targeted network drive path);

-n –encryption_percent (percentage of encryption); and

--fork (create a child process for encryption).

Including threads allows the threat actors more granular control over the number of CPU cores in use, increasing the speed and efficiency of the encryption process. The Akira_v2 encryptor also adds a layer of protection, using the Build ID as a run condition to hinder dynamic analysis. The encryptor is unable to successfully execute without the specific Build ID. Akira_v2 also can deploy against only VMs using vmonly and stop running VMs with stopvm functionalities. After encryption, the Linux ESXi variant may include the file extension akiranew or an added file named akiranew.txt as a ransom note in directories where files were encrypted with the new nomenclature.

Table 1 lists publicly available tools and applications used by Akira threat actors, including legitimate tools repurposed for their operations. These tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.

Update Nov. 13, 2025:

A Python library that allows users to work with various network protocols.

Indicators of Compromise

Disclaimer: These IOCs were observed between June 2023 and August 2025. The authoring organizations recommend vetting or investigating these IOCs prior to taking action, such as blocking.

See Table 2 through Table 9 for Akira ransomware IOCs.

3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75

0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c

ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849eb8fc

dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198

131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07

9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c

9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065

2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83

7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be

95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a

0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d

C9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

Update Nov. 13, 2025:

Update Nov. 13, 2025:

Note: Trusted third-party analysis confirmed the Akira threat actors’ ransomware samples in Table 6 were created on Dec. 28, 2023.

cmd.exe /Q /c esentutl.exe /y

"C:\Users\ \AppData\Roaming\Mozilla\Firefox\Profiles\ .defaultrelease\key4.db" /d

"C:\Users\ \AppData\Roaming\Mozilla\Firefox\Profiles\ .defaultrelease\key4.db.tmp”

Note: Akira threat actors use these commands to access Firefox data.

cmd.exe /Q /c esentutl.exe /y

"C:\Users\ \AppData\Local\Google\Chrome\User Data\Default\Login Data" /d

"C:\Users\ \AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp”

Note: Akira threat actors use these commands to access Google Chrome data.

MITRE ATT&CK TACTICS AND TECHNIQUES

See Table 10 through Table 21 for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, see CISA and MITRE ATT&CK’s Best Practices for MITRE ATT&CK Mapping and CISA’s Decider Tool .

Command and Scripting Interpreter: PowerShell

Akira threat actors use PowerShell to execute malicious scripts and Living Off the Land Binary (LOLBin) commands for execution, persistence, credential harvesting, lateral movement, and disabling security controls to evade detection.

After using Ngrok to establish encrypted sessions, Akira threat actors use PowerShell and WMIC to disable services and execute malicious scripts.

Akira threat actors use commercial penetration testing tools, namely Cobalt Strike, during their operations to achieve lateral movement, perform C2 procedures, and gain elevated privileges.

Command and Scripting Interpreter: Visual Basic

Akira threat actors use PSEXESVC.exe to enable remote code execution and deploy payloads.

Akira threat actors can create local user accounts by adding them to local admin groups to establish persistent backdoors.

Akira threat actors exploit unpatched software vulnerabilities (e.g., Veeam Backup and Replication CVEs) to gain elevated privileges on hosts or servers (enabling access to sensitive data), and for credential harvesting.

Akira threat actors use POORTRY malware written as a signed vulnerable Windows driver to deploy BYOVD techniques to obtain elevated privileges.

Obfuscated Files or Information

Akira threat actors use the takedown command to assume ownership of directories and files and use the icacls command to modify discretionary access control lists.

Akira threat actors use a BYOVD technique to disable antivirus software.

Akira threat actors use PowerTool to exploit Zemana AntiMalware driver and terminate antivirus defensive processes.

Akira threat actors uninstall EDR systems to evade endpoint detection.

Impair Defenses: Disable or Modify System Firewall

Akira threat actors use a compromised device as a proxy server to conceal their malicious C2 infrastructure and associated IP address from network defenders.

OS Credential Dumping: Security Account Manager

Akira threat actors dump credentials from repositories like the Variable Bit Rate (VBR)-configuration database.

Akira threat actors use LaZagne to recover stored passwords on Windows, Linux, and macOS systems.

Akira threat actors leverage tools such as NetExec or Mimikatz with the –dpapi option to dump credentials stored in the Windows Credential Manager, allowing them to gain unauthorized access to additional systems or accounts within the network.

Akira threat actors use Advanced IP Scanner and NetScan to perform network reconnaissance by locating computers, scanning ports, identifying network devices, accessing shared folders, and enabling remote control via RDP and Radmin.

Akira threat actors use SoftPerfect network scanners ( netscan.exe ) to perform discovery and retrieve network device information through WMI, SNMP, HTTP, SSH, and PowerShell.

Akira threat actors use tools like PCHunter64 to acquire detailed process and system information.

Akira threat actors use DiskCheck software to query remote systems for information on disk drives and installed software.

Account Discovery: Domain Account

Akira threat actors use Adfind.exe to query and retrieve information from Active Directory.

Akira threat actors use the net Windows command to enumerate domain information.

Akira threat actors use nltest /DOMAIN_TRUSTS commands to enumerate domain trusts.

Akira threat actors use Mimikatz to view and save authentication credentials, such as Kerberos tickets.

Akira threat actors use Ngrok to create a secure tunnel to servers the actors use to exfiltrate data.

Akira threat actors use SystemBC malware as a proxy bot.

Ingress Tool Transfer

Akira threat actors download tools, many of which are staged in the PerfLogs directory, and use the WebClient.DownloadString() method to download Cobalt Strike beacons.

Akira threat actors use STONESTOP malware to load additional payloads.

Akira threat actors use legitimate desktop support software like AnyDesk to obtain remote access to victim systems.

Akira threat actors use SystemBC malware as a RAT.

Akira treat actors use Ngrok to hide C2 and remote access/exfiltrate traffic inside legitimate HTTPS connections, bypass perimeter defenses, and maintain covert persistent access.

The authoring organizations recommend organizations implement the mitigations below to improve their cybersecurity posture based on the threat actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s CPGs webpage for more information on the CPGs, including additional recommended baseline protections.

Update Nov. 13, 2025:

For mitigations specific to K–12 schools, see CISA’s guidance Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats .

The authoring organizations recommend organizations implement the following mitigations:

Prioritize remediating known exploited vulnerabilities and keep all operating systems, software, and firmware up to date, as timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats; prioritize patching known exploited vulnerabilities in internet-facing systems [ CPG 1.E ].

Implement identity, credential, and access management (ICAM) policies across the organization and then require MFA for all services to the extent possible, particularly for webmail, VPNs, and accounts that access critical systems [ CPG 2.H ].

Require all accounts with password logins (e.g., service accounts, admin accounts, and domain admin accounts) to comply with NIST’s standards ; require employees use long passwords and consider not requiring recurring password changes, as these can weaken security [ CPG 2.C ]. Use longer passwords consisting of at least 15 characters and no more than 64 characters in length [ CPG 2.B ]. Store passwords in hashed format using industry-recognized password managers. Add password user “salts” to shared login credentials. Avoid reusing passwords. Implement multiple failed login attempt account lockouts [ CPG 2.G ]. Disable password “hints.” Refrain from requiring password changes more frequently than once per year. Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.

Use longer passwords consisting of at least 15 characters and no more than 64 characters in length [ CPG 2.B ].

Store passwords in hashed format using industry-recognized password managers.

Add password user “salts” to shared login credentials.

Avoid reusing passwords.

Implement multiple failed login attempt account lockouts [ CPG 2.G ].

Disable password “hints.”

Refrain from requiring password changes more frequently than once per year.

Note: NIST guidance suggests favoring longer passwords instead of requiring frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.

Maintain offline backups of data and regularly test and maintain backup and restoration processes [ CPG 2.R ]; implementing this practice helps organizations avoid severe operational interruptions and prevent scenarios in which data is irretrievable.

Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, or the cloud) [ CPG 2.F , 2.R , 2.S ].

Segment networks to prevent the spread of ransomware, as network segmentation can help control traffic flows between and access to various subnetworks, and by restricting adversary lateral movement [ CPG 2.F ].

Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool [ CPG 3.A ]. To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. EDR tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.

To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network.

EDR tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.

Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems; this prevents threat actors from directly connecting to remote access services that they have established for persistence.

Install, regularly update, and enable real-time detection for antivirus software on all hosts.

Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts [ CPG 1.A , 2.O ].

Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [ CPG 2.E ].

Disable unused ports [ CPG 2.V ].

Consider adding an email banner to emails received from outside of your organization [ CPG 2.M ].

Disable hyperlinks in received emails.

Implement time-based access for accounts set at the admin level and higher ; for example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the Zero Trust Maturity Model ). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.

This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need.

Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.

Disable command-line and scripting activities and permissions, since privilege escalation and lateral movement often depend on software utilities running from the command line; if threat actors cannot run these tools, they will have difficulty escalating privileges and moving laterally [ CPG 2.E , 2.N ].

Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [ CPG 2.K , 2.L , 2.R ].

Validate Security Controls

In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.

Organizations should get started by following these steps:

Select an ATT&CK technique described in this advisory ( Table 10 to Table 21 ).

Align your security technologies against the technique.

Test your technologies against the technique.

Analyze your detection and prevention technologies’ performance.

Repeat the process for all security technologies to obtain a set of comprehensive performance data.

Tune your security program—including people, processes, and technologies—based on the data generated by this process.

The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.

Stopransomware.gov is a whole-of-government approach that provides one central location for ransomware resources and alerts.

CISA’s #StopRansomware Guide provides organizations with comprehensive best practices to mitigate the risk of ransomware attacks.

CISA’s Known Exploited Vulnerabilities Catalog is an authoritative resource for organizations to support improvement of their patch management best practices.

CISA’s Implementing Phishing-Resistant MFA is a fact sheet intended for network defenders to mitigate threats to accounts and systems that use MFA.

CISA’s Cyber Hygiene Services help organizations reduce the risk of a successful cyberattack.

CISA’s Cyber Security Evaluation Tool (CSET) provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture; see Downloading and Installing CSET for step-by-step guidance to help your organization evaluate cybersecurity practices on your networks.

CISA’s Ransomware Risk Assessment helps assess an organization’s ability to counteract a ransomware infection.

Department of Health and Human Services’ (HHS’s) Cybersecurity Performance Goals is a resource to help healthcare organizations implement high-impact cybersecurity practices.

Your organization has no obligation to respond or provide information back to FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to FBI, reporting must be consistent with applicable state and federal laws.

FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.

Additional details of interest include a targeted company point of , status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.

FBI, CISA, and co-sealers do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, FBI and CISA urge you to promptly report ransomware incidents to FBI’s Internet Crime Complain Center (IC3) , a local FBI Field Office , or CISA via the agency’s Incident Reporting System or its 24/7 Operations Center ( @cisa.dhs.gov ), or by calling 1-844-Say-CISA (1-844-729-2472).

U.S. Healthcare and Public Health sector organizations may report incidents to FBI or CISA, but also can reach out to HHS at [email protected] for cyber incident support focused on mitigating adverse patient impacts.

German organizations may file a complaint via Germany’s online complaint platform , report enterprise incidents to Central Points for Cybercrime (ZAC) by email at [email protected] , or by phone at +49 0711 5401-2444, or individuals can report criminal incidents to Baden-Württemberg’s online portal .

Netherlands organizations may report incidents by emailing NCSC-NL at [email protected] .

French organizations may report incidents to the national police by telephone +33 0 805 805 817, through the French National Police’s online portal , or through the Office Anti-Cybercriminalite’s (OFAC’s) platform Pharos 18 to report illegal content on the internet, or their Thésée 19 platform to report online scams (including ransomware).

The information in this report is being provided “as is” for informational purposes only. The authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favor by FBI and co-sealers.

Cisco, Sophos, and Fortinet contributed to this advisory.

April 18, 2024: Initial version.

November 13, 2025: Updated to recent TTPs and IOCs.

Omar Santos, “Akira Ransomware Targeting VPNs without Multi-Factor Authentication,” Cisco Blogs (blog), Cisco , last modified August 24, 2023, ; Heresh Zaremand, “Akira Ransomware and Exploitation of Cisco Anyconnect Vulnerability CVE-2020-3259,” Truesec (blog), Truesec , last modified January 29, 2024, ; and Trend Micro Research, “Ransomware Spotlight: Akira,” Trend Micro , October 5, 2023, .

Shunichi Imano and James Slaughter, ”Ransomware Roundup – Akira,” Fortinet (blog), Fortinet , last modified April 24, 2024, .

Fortinet FortiGuard Threat Analysis Team, “Outbreak Alert: Akira Ransomware,” Fortinet FortiRecon , last modified April 23, 2024, .

“Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption,” MicrosoftThreat Intelligence (blog), Microsoft , last modified July 29, 2024, .

“Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption.”

Trend Micro Research, “ Ransomware Spotlight: Akira .”

Pierluigi Paganini, “Ransomware Groups Target Veeam Backup & Replication Bug,” Security Affairs , July 15, 2024, ; Sean Gallagher, “The Sophos Annual Threat Report: Cybercrime on Main Street 2025,” Sophos News , Sophos, last modified, April 16, 2025, ; and Sergiu Gatlan, “Akira and Fog ransomware now exploit critical Veeam RCE flaw,” Bleeping Computer, last modified October 10,2024,

Ryan Terry, “Kerberoasting Attacks: What They Are and How to Defend,” Cybersecurity 101: The Fundamentals of Cybersecurity , CrowdStrike , last modified March 26, 2025, .

Morgan Demboski, “Akira, again: The ransomware that keeps on taking,” Sophos News , December 21, 2023, .

Trend Micro Research, “ Ransomware Spotlight: Akira .”

Jamie Smith, “Privilege escalation: unravelling a novel cyber-attack technique,” IT Security Guru , July 23, 2024, .

James Nutland and Michael Szeliga, “Threat spotlight: Akira ransomware continues to evolve,” Cisco Talos (blog), Cisco, last modified October 21, 2024,

Steven Campbell, Akshay Suthar, and Stefan Hostetler, “Artic Wolf Labs Observes Increased Fog and Akira Ransomware Activity Linked to SonicWall SSL VPN,” Artic Wolf Labs (blog), Arctic Wolf , October 24, 2024, .

Jaramillo, Paul, “Akira Ransomware is ‘bringin’ 1988 back,’” Sophos , May 9, 2023, .

Igor Pavlov, “7-Zip file archiver,” 7-Zip, October 22, 2025, .

Katie Terrel Hanna, “What is FileZilla?” TechTarget, October 22, 2025, .

“NetScanTools Definition” Northwest Performance Software, October 22, 2025, .

French organizations may report illegal content on the internet to OFAC’s Pharos platform.

French organizations may report online scams, including ransomware, to OFAC’s Thésée platform.

This product is provided subject to this Notification and this Privacy & Use policy.